Recently I often edited a txt file with Notepad++ on Windows XP and gedit on Linux (Mint). During shutdown on windows, it seems, that file was corrupted. This is the second time that this happens and both corrupted files now start with INDX(.

Unfortunately I made a backup (with rsync) this morning, which also copied the corrupted file.

Perhaps this also could have anything to do with problems on the hard disk, but its more unlikely, because I checked it already with different tools on both hard disks.. (chkdsk, smart)

This is the start of the file-content: (if you need everything, please ask me)

I think this won't help me, because this only covers lost files or problems with the filesystem or hard disk, but neither of these seems to be the case, as I already checked if there are any problems and my file isn't lost - just corrupted. Thanks anyway!
–
JoschuaAug 7 '11 at 16:11

@Joschua: That's just ignorant behavior, as you can recover it if it hasn't been overwritten by further usage. If you do not do this now, you will never manage to recover it. I also suggest you to use sync on shutdown to prevent faults like these, and use a tool like HD Tune as your HDD might be malfunctioning.
–
Tom WijsmanAug 7 '11 at 17:20

Ok, I will try PhotoRec in the hope that it also handles file corruption. Just as you said, I already stopped writing data to the hard drive.
–
JoschuaAug 7 '11 at 18:04

1

Hmm, didn't work :| I got a lot of files, but I couldn't find anything with grep. It seems I have to write everything again, Yay! :( One question: Do you know what this INDX( means?
–
JoschuaAug 7 '11 at 22:20

1

@Joschua: In the standard index header the four byte structure element, magicNumber contains the actual ASCII string "INDX" as a marker to denote the actual beginning of the index standard header. - Source:NTFS Forensics - It seems to me the original file record is pointing at a random location...
–
Tom WijsmanAug 8 '11 at 12:16